[Danielku15]

The .NET publish job exchanges a GitHub OIDC token for a short-lived nuget.org API key (NuGet/login) right before pushing, replacing the long-lived NUGET_API_KEY secret. The job and its callers in Publish and Release grant id-token: write.

nuget.org matches its trust policy against the job_workflow_ref claim, which names ~publish_dotnet.yml rather than the calling workflow, so a single policy covers nightly and release publishing. NUGET_USER holds the nuget.org account that created the policy. Dry runs also request a key, so they verify the policy without pushing.

Issues

No issue, internal house-keeping.

Proposed changes

The .NET publish job exchanges a GitHub OIDC token for a short-lived
nuget.org API key (NuGet/login) right before pushing, replacing the
long-lived NUGET_API_KEY secret. The job and its callers in Publish and
Release grant id-token: write.

nuget.org matches its trust policy against the job_workflow_ref claim,
which names ~publish_dotnet.yml rather than the calling workflow, so a
single policy covers nightly and release publishing. NUGET_USER holds
the nuget.org account that created the policy. Dry runs also request a
key, so they verify the policy without pushing.

Checklist

• I consent that this change becomes part of alphaTab under its current or any future open source license
• This PR is linked to an accepted issue (see above)
• Changes are implemented
• New tests were added
• I have read AGENTS.md if an AI helped draft any part of this PR

AI authorship disclosure

• No AI agent authored any part of this PR (description, code, tests, or commit messages)
• An AI agent contributed to this PR. The AI-authored disclosure block
  (alphatab-ai-authored-v1) is present at the top of this body, and I have
  personally reviewed every change and can explain each one

Further details

• This is a breaking change
• Docs / release notes updated in website/